Refactoring network top countries to use useSearchStrategy

[angorayc]

Summary

Screen.Recording.2022-07-11.at.17.13.19.mov

Steps to verify:

1. Index a sample data

POST filebeat-7.16.2-2022.07.11-000001-MyTest/_doc
{
  "agent": {
    "build_date": "2022-04-01 13:13:45 +0000 UTC",
    "name": "bastion00",
    "commit": "58327465d29b69f55dde92715cd06968311a15ab",
    "id": "7a25ee1d-0b43-435e-afcc-891ae418eb1d",
    "type": "filebeat",
    "ephemeral_id": "b33f49bc-326d-4588-a74d-b0637b268c05",
    "version": "8.2.0"
  },
  "log": {
    "file": {
      "path": "/var/log/traefik/access.log.json"
    },
    "offset": 2460703619
  },
  "traefik": {
    "access": {
      "OriginContentSize": 18,
      "entryPointName": "web",
      "ClientAddr": "139.177.197.217:47834",
      "RequestScheme": "http",
      "OriginStatus": 307,
      "RouterName": "redirector@file",
      "Overhead": 212185,
      "OriginDuration": 171531,
      "RequestCount": 407821598,
      "RetryAttempts": 0
    }
  },
  "destination": {
    "geo": {
      "continent_name": "Europe",
      "country_iso_code": "DE",
      "country_name": "Germany",
      "location": {
        "lon": 9.491,
        "lat": 51.2993
      }
    },
    "as": {
      "number": 44486,
      "organization": {
        "name": "SYNLINQ"
      }
    },
    "address": "45.85.219.239",
    "port": 4444,
    "ip": "45.85.219.239"
  },
  "source": {
    "geo": {
      "continent_name": "North America",
      "region_iso_code": "CA-ON",
      "city_name": "Toronto",
      "country_iso_code": "CA",
      "country_name": "Canada",
      "region_name": "Ontario",
      "location": {
        "lon": -79.3623,
        "lat": 43.6547
      }
    },
    "as": {
      "number": 63949,
      "organization": {
        "name": "Linode, LLC"
      }
    },
    "address": "139.177.197.217",
    "port": 47834,
    "ip": "139.177.197.217"
  },
  "message": """{"ClientAddr":"139.177.197.217:47834","ClientHost":"139.177.197.217","ClientPort":"47834","ClientUsername":"-","DownstreamContentSize":18,"DownstreamStatus":307,"Duration":383716,"OriginContentSize":18,"OriginDuration":171531,"OriginStatus":307,"Overhead":212185,"RequestAddr":"45.85.219.239:4444","RequestContentSize":0,"RequestCount":407821598,"RequestHost":"45.85.219.239","RequestMethod":"CONNECT","RequestPath":"","RequestPort":"4444","RequestProtocol":"HTTP/1.1","RequestScheme":"http","RetryAttempts":0,"RouterName":"redirector@file","StartLocal":"2022-07-11T15:58:20.660776429Z","StartUTC":"2022-07-11T15:58:20.660776429Z","entryPointName":"web","level":"info","msg":"","time":"2022-07-11T15:58:20Z"}""",
  "url": {
    "path": "",
    "domain": "45.85.219.239:4444"
  },
  "network": {
    "community_id": "1:WMjixKW/TOQZLDN+gfxg0TRBOvA=",
    "transport": "tcp"
  },
  "input": {
    "type": "log"
  },
  "@timestamp": "2022-07-12T15:58:20.660Z",
  "related": {
    "ip": [
      "139.177.197.217",
      "45.85.219.239"
    ]
  },
  "ecs": {
    "version": "8.0.0"
  },
  "host": {
    "name": "bastion00"
  },
  "http": {
    "request": {
      "method": "CONNECT",
      "body": {
        "bytes": 0
      }
    },
    "response": {
      "status_code": 307,
      "body": {
        "size": 18
      }
    },
    "version": "1.1"
  },
  "event": {
    "duration": 383716,
    "created": "2022-07-11T15:58:21.115Z",
    "module": "traefik",
    "start": "2022-07-11T15:58:20.660776429Z",
    "end": "2022-07-11T15:58:20.661Z",
    "dataset": "traefik.access"
  },
  "user": {
    "name": "-"
  }
}
}

2. Navigate to network page, and make sure filebeat-* is selected
3. Check network top countries are loaded

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[machadoum]

LGTM!

Thank you for sharing the test data. It was very helpful.

[angorayc]

@elasticmachine merge upstream

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 5393227
• Storybooks Preview

Failed CI Steps

• Security Solution Tests #3

Test Failures

• [job] [logs] Security Solution Tests #3 / All hosts table it renders risk column

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	5.2MB	5.2MB	-726.0B

History

• 💚 Build #56812 succeeded 49d57f4
• 💔 Build #56747 failed dd5bfd1

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream